4

IP addresses are "personal data" according to the GDPR. When saving IP addresses in web server access logs, data subjects have the right to get the log entries for the IP addresses they used (article 15 GDPR).

If the IP address is the only personal data in the log, a controller has no way to verify that a requesting person is actually the data subject. Even the requesting person’s ISP could only verify that the person is the subscriber (i.e., that the subscriber’s Internet connection had this specific IP address at a specific time), but it’s possible that someone else used the subscriber’s Internet connection at that time (e.g., a family member).

Does this mean that a controller never has to provide the log entries if the IP address is the only personal data involved?

1

Does this mean that a controller never has to provide the log entries if the IP address is the only personal data involved?

The controller has the right to require proof that the personal data is personally data relating to the Internet subscription belonging to natural person making the request.

The burden of proof is borne by the requester.

However, I can imagine a requester first going to his ISP, requesting a complete timestamped log of all the IP-addresses he has been given at various time, getting it notarized, and then providing the controller with this log to get the matching log entries in the controllers web server logs.

However, I can not see what possible use the data subject would have of making such an access request.

(PS: This should not be a access request hard for the controller to comply with. A one line shell-script using a regexp should do it.)

  • But even if the person gets the info from the ISP: the ISP doesn’t know which person used these IPs, only which Internet connection (and who this connection belongs to). So a controller can never be sure that the subscriber actually was the person who was surfing at that time -- it could as well have been a guest or a family member -- and there is no proof (which the controller could verify) who actually surfed. Right? – unor May 29 '18 at 10:33
  • @unor. See updated answer. – Free Radical May 29 '18 at 11:08
  • (I’m not sure I understand your edit correctly …) Do you say that the controller should give out the data if the requester is provably the subscriber? Even if the subscriber’s spouse/child/friend could be the data subject (when they used the subscriber’s Internet connection)? – unor May 29 '18 at 18:34
  • @unor a similar problem exists with traffic enforcement cameras: they prove something about the car, but not who was driving. – phoog Jun 28 '18 at 13:11
0

IP addresses are "personal data" according to the GDPR.

Wrong.

IP addresses may or may not be personal data, and that directly depends on whether the persons who left those addresses in the log can be identified by the controller/processor at reasonable time/costs (that is, without hiring detectives, data scientists etc.).

If, as you say, "the IP address is the only personal data in the log" then it is not personal data, and therefore the controller does not have to provide anything.

  • 3
    In C‑582/14 the Court of Justice (EU) has already determined that IP adresses are personal data, the GDPR does not change that: Thus, it appears that the online media services provider has the means which may likely reasonably be used in order to identify the data subject, with the assistance of other persons, namely the competent authority and the internet service provider, on the basis of the IP addresses stored. – wimh May 29 '18 at 14:30
  • @wimh That was a special case where the means of identifying the IP address owner were indeed available to the online media services provider. In no way does that mean that such means are available at all times. Laws do not directly refer to cases to "change" them. GDPR is a new law and the quoted case is not a precedent decided on GDPR, so judges would rebuild their decisions from scratch. – Greendrake May 29 '18 at 22:18
  • 1
    You shouldn't have been downvoted for this answer. C‑582/14 clearly states that an IP address being personal data is contingent on having the means to identify the data subject from the IP address and other data. – Lag May 31 '18 at 7:26
  • 2
    @Lag, I did not downvote, check my stats, I have never downvoted on this site. I don't have the "Critic" badge. And having the means to identify the data subject includes going to court requesting if from the ISP. It is not prohibited by law for ISP's to identify an IP address. For example in the case of a copyright violation, ISP's give information about the owner to the copyright holder. Quoting the Advocate General: However, so long as they exist, no matter how restrictive they may be in their practical application, they constitute a ‘reasonable means’, for the purpose of Directive 95/46. – wimh Oct 2 '18 at 15:01
  • @wimh I must defer to the A-G, although he seems to be saying any practical and lawful possibility (my emphasis) is reasonable. – Lag Oct 12 '18 at 9:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.